PT-2022-20749
CVE-2022-31471
·
Published
2022-07-26
·
Updated
2022-08-06
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
untangle versions 1.2.0 and earlier
Description
untangle is a python library to convert XML data to python objects. It improperly restricts XML external entity references, allowing a remote unauthenticated attacker to read the contents of local files by exploiting this issue.
Recommendations
For versions 1.2.0 and earlier, update to version 1.2.1 to resolve the issue. As a temporary workaround, consider restricting XML external entity references to minimize the risk of exploitation.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾